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We consider a general notion of private quantum codes wherein qubits are encoded into quantum 
subsystems. Private quantum channels, private subspaces, and a previously considered notion of 
private subsystems are all captured as special cases of this general phenomena. We provide a simple 
example that highlights the main differences between mappings on subsystems and subspaces and 
show that certain classes of channels can only be private in this subsystem setting. We also set out 
testable conditions for deciding when a code is private for a given channel and we discuss connections 
with quantum error correction. 

PACS numbers: 03.67.Hk; 03.67.Pp 



INTRODUCTION 

The most essential primitive for private communica- 
tion between two parties, Alice and Bob, in classical com- 
putation is the one-time pad. In such a scheme, the two 
parties share a secret key that is unknown to an external 
observer Eve; this key enables reliable communication by 
the parties as the message appears to be a random mix- 
ture of input bits from Eve's viewpoint without the key. 

Private quantum codes were initially introduced as the 
quantum analogue of the classical one-time pad. The ba- 
sic setting for a "private quantum channel" 0, Q is as 
follows: Alice and Bob share a private classical key that 
Alice uses to inform Bob which of a set of unitary op- 
erators {Ui} she has used to encode her quantum state: 
p i-> UipUj . With this information in hand, Bob can de- 
code and recover the state p without disturbing it. The 
set of unitaries {Ui} and the probability distribution {pi} 
that makes up the random key which determines the en- 
coding unitary are shared publicly. Thus, without further 
information, Eve's description of the system is given by 
the random unitary channel $(p) = J2iPiUipU} ■ By se- 
lecting certain sets of unitary operators with appropriate 
coefficients, the random unitary channel will provide Eve 
with no information about the input state. 

The body of work on private quantum codes now in- 
cludes a variety of other applications, with realizations 
both as subspaces and subsystems of Hilbert space. Pri- 
vate shared reference frames exploit private subspaces 
and subsystems that also arise from the ignorance as- 
sociated with an eavesdropper's description of a system 
[H> 13 • Another cryptographic application is quantum se- 
cret sharing 0, Q . If a system is mapped by a channel to 
n systems, distributed among n parties, one can ask how 
to encode quantum information into the system in such 
a way that any set of parties with less than k members 
can learn nothing about it. And the answer is that it 
must be encoded into subsystems that are private for the 



reduction of the channel to any k — 1 or fewer parties. 
The idea of optimality of private quantum channels, in 
terms of minimizing the entropy of the classical shared 
key, was addressed in Q . There are also bridges between 
these works and quantum error correction, formalized by 
the complementarity results of Q . Connections between 
the study of private quantum codes and the theory of 
operator algebras have recently been found as well [9j. 

In this Letter we consider a general notion of private 
quantum codes wherein qubits are encoded into quan- 
tum subsystems. All the previously considered instances 
of private quantum codes — including private quantum 
channels, private subspaces, and the private subsystems 
referenced above — are captured as special cases of this 
general phenomena. We consider a phase damping ex- 
ample throughout the presentation that highlights the 
main differences between mappings on subsystems and 
subspaces, and show that certain classes of channels can 
only be private in this more subtle subsystem sense. We 
also set out algebraic conditions that characterize privacy 
of a code in terms of the Kraus operators for a given quan- 
tum channel, and we discuss connections with quantum 
error correction. 

We now describe our basic notation and nomenclature. 
We will introduce extra subsystem terminology later. 
Given a quantum system S, with (finite-dimensional and 
complex) Hilbert space also denoted by S, we will use 
customary notation such as p, a for density operators 
and X, Y for arbitrary operators on S. The set of lin- 
ear operators on S is denoted by C(S). Linear maps on 
£(S) can be viewed as operators acting on the operator 
space £(S). We use the term (quantum) channel to refer 
to a completely positive and trace-preserving linear map 
$ : C(S) — > C(S). Such maps describe (discrete) time 
evolution of open quantum systems in the Schrodinger 
picture, and can always be written in the Choi-Kraus 
operator-sum form $(p) = J2i VipV-i f° r some operators 
Vi in C(S). The composition of two maps will be denoted 
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by $ o vfr(o-) = $(*(cr)). 

A (linearly closed) subspacc C of S is said to be a 
private subspace for $ if there is a density operator p on 
5 such that §(\ip}(ip\) = p for all pure states \ip) in C. 
By linearity, $(p) = p for all p in C(C). We could also 
consider a collection of private states not associated with 
a subspace of the Hilbert space, but, as in quantum error 
correction, we wish to allow for arbitrary superpositions 
of our code states and this demands the set of states 
considered are linearly closed. 

PRIVATE CODES FOR PHASE DAMPING 

The completely depolarizing channel ($(p) = di ^g l 
for all p) is the simplest, concise example of a quantum 
channel that is private. In this case the entire Hilbert 
space acts as a private code for the channel, and so in 
order to implement such a private channel a full set of 
Pauli rotations must be available. This leads to a very 
basic question in the study of private quantum codes: Do 
there exist channels with fewer physical operations such 
that we can still encode qubits for privacy? 

Perhaps the most trivial class of channels one could 
imagine would be the family of phase damping chan- 
nels that can be applied to any qubit of a larger Hilbert 
space iS of n qubits, 

Hp) = \(p + z tP z i ), Vpe£(S). (l) 

A single qubit phase damping channel is not private. Yet 
we can ask: can composing the phase damping channel 
on multiple qubits yield a private subspace CCS? Such 
a question is analogous to the sort of questions that have 
been asked in quantum error correction for some time; 
for example, given a set of errors that are uncorrectable 
on a single qubit, does there exist a larger Hilbert space 
such that the action of the error on the encoded Hilbert 
space is correctable? The answer to such a question in 
quantum error correction is yes, as demonstrated by the 
five-qubit code which corrects for arbitrary single-qubit 
errors, an error that would be uncorrectable if one did 
not have access to a larger Hilbert space to encode the 
quantum information into a quantum code. 

We shall define the map A as the composition of the 
maps Aj on each of the n qubits of the state p G S, 

A(p) =A„oA„_io...oAi(p) (2) 

Equivalently one could consider the n-product map Af ™ 
of the single qubit channel A^ For any input state p, this 
channel will decohere all off-diagonal terms in the com- 
putational basis; as such, the resulting output density 
matrix will be diagonal. 

Consider the case when n — 2. Every output state of 
A has the form 

po = ^(lI + cdZ + pZI + iZZ), (3) 



where / and Z are the one-qubit identity and Pauli Z 
matrices. The goal is to find a subspace C of dimension 
2 and a state po £ C(S) such that A(p) = p Vp £ C{C). 
This would show that A has a private qubit, defined by 
a pair of orthogonal logical states |0l), in C. 

However, one can show that such a subspace does not 
exist. In fact we can prove the following more general 
result, which applies to sets of commuting normal Kraus 
operators as well. For succinctness we leave the proof for 

m 

Theorem 1 Let A be a channel with Kraus operators 
given by a set of weighted commuting unitary operators 
{v/pjf/i}, where yfpi is a scaling factor such that ^2 i Pi = 
1. Then there exists no private subspace C for A. 

Is this the end of the story? This result is intuitive — 
at first glance it certainly does not "feel" as though we 
should be able to find private codes for channels such as 
the phase damping maps A = A„ o ■ • • o A2 o Ai . However, 
if we allow ourselves to move away from basic subspace 
encodings to more delicate forms of encodings and em- 
beddings into Hilbert space, surprisingly we do discover 
privacy for these channels. And the answer will lead us 
to a general form of subsystem code. 

Consider the following logically encoded qubits in 2- 
qubit Hilbert space: 

p L = j{II + aXX + [3YI + 1 ZX). (4) 

This does indeed describe a single qubit encoding, as 
Eq. (0} describes the coordinates for a logical Bloch 
sphere in 2-qubit Hilbert space with logical Pauli opera- 
tors given by X L = XX, Y L = YI, Z L = ZX. 

Now, observe that the dephasing map A = A2 o Ai 
acting on each density operator pl produces an output 
state that is maximally mixed; that is, A(pl) = \ II for 
all pl- Thus, we see that Eq. (@| yields a private qubit 
"code" for the dephasing map A. However, we know from 
Theorem [1] that the input space cannot be a subspace. Is 
it a subsystem code, at least in the sense of Hil? The 
answer is no, for the same reason: as noted in the next 
section, the existence of such a private subsystem code 
immediately implies the existence of a traditional sub- 
space code. This example motivates a new, more general 
type of a private subsystem. 

PRIVATE QUANTUM SUBSYSTEMS 

A quantum system B is a subsystem of S if we can write 
S = (A®B)<3) (A® B)^. This definition is symmetric in 
that A is also considered a subsystem of S. The subspaces 
of S can be viewed as subsystems B for which A is one- 
dimensional. As before, C(S) will denote the operators 
on S, and now a subscript such as o~b means the operator 
belongs to C(B). 
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Definition 2 Let $ : C(S) — > C(S) be a channel and let 
B be a subsystem of S. Then B is a private subsystem 
for $ if there is a p € £{S) and a a € £(^4) such that 



h^CNOT^CNOT^ acts as 



® ctb) = po Vctb 



(5) 



In the case of a subspacc (dim A = 1) this definition 
captures the basic notion of private subspaces considered 
previously. For a bona fide subsystem (dim A > 1), how- 
ever, this notion of private subsystem is more general 
than what has been considered in [3-0, Q , which we refer 
to as "operator private subsystems" in this discussion. In 
our definition, we have weakened the requirement that 
Eq. (|S|) must hold for all a a, and only demand that it 
holds for a single state on A. From a channel perspec- 
tive, we have removed the operator private subsystem 
requirement that the map $ needs to split into a prod- 
uct of maps on the individual subsystems. As opposed 
to operator private subsystems, we shall see below that 
these more general private subsystems can exist without 
the existence of private subspaces. This concept of pri- 
vate subsystem also generalizes the notion of "private 
quantum channel" to arbitrary channels — the framework 
presented in [l|, Q can be regarded as the special case of 
private subsystems for random unitary channels. And we 
note that while the established definition of private quan- 
tum channel does include an ancilla as above, the extra 
ancilla state (our cm) and subsystem structure does not 
figure centrally into [H, 0]; indeed, all examples of private 
channels provided therein are in fact subspaces. 

Returning to our phase damping example, recall the 
private code in the n = 2 case is encoded in the logical 
density operators pl = \(II + aXX + [3YI + jZX), and 
that each of these operators produces an output state for 
A that is maximally mixed. It turns out that this private 
code can be viewed as a single qubit subsystem embedded 
inside two qubit space, where the ancilla operator a a in 
this case is the single qubit identity operator J2; that is, 
up to a unitary equivalence, the set of operators p^ can be 
seen to generate the two qubit operator algebra I 2 <£> M2 , 
where M2 is the algebra of 2 x 2 complex matrices. To 
see this, it is enough to show that all two qubit states p 
of the form p = + aXX + (3YI + ^ZX) can 

be sent through appropriate unitary gates to obtain p' of 
the form p' = \h®\{h + a'X + (3'Y + -y'Z). Since 
/, X, Y, Z form a basis for M2, the claim will follow. 

One can verify that an application of the inverse 
of the T = ^(|0)((0| + (1|) + i|l>«0| - (1|)) gate 
on the first qubit, and applications of CNOT 2 \ and 
CNOTi,2, with the second qubit serving as the con- 
trol qubit followed by the first qubit in the con- 
trolled operations, yields the desired transformation. 
The composition CNOT h2 CNOT 2 ,i ((T* <g> h)(-)(T <g> 



XX 
YI\ 
ZX 



YX 
ZI 
XX 



ZY 
ZZ\ 
IX i 



IY 
IZ 
IX. 



Thus, we obtain p' = \{h + jIX + alY + (51 Z). In 
defining the unitary U = CNOT 1>2 CNOT 2)1 o (T* ® h), 
we see the set of operators V piJJ^ generate the algebra 
I 2 ® M 2 . 

Evidently this example fits into the framework of the 
above definition. Moreover, as opposed to operator pri- 
vate subsystems, by Theorem 1 this private code exists in 
the absence of any private subspaces. Below we also show 
this private code has no complementary error-correcting 
counterpart, a further deviation from the operator pri- 
vate subsystem framework Q . 



Testable Conditions 

If we are given a quantum channel $(p) = ^2% ViPV} 
and a subsystem B, we can ask if it is possible to decide 
whether B is private for <£•; and more to the point, we 
can ask if this can be answered in terms of the Kraus 
operators Vi for the channel. The analogous question in 
quantum error correction is answered by the fundamental 
Knill-Laflammc conditions 11( , which provide an explicit 
set of algebraic constraints in terms of the Kraus opera- 
tors and the code, and allow one to test whether a given 
code is correctable for a channel. The generalization of 
these conditions to the case of operator error-correcting 
subsystems was established in [12l4l4 1 . 

The following result answers this question for private 
quantum subsystems. In addition to the Kraus operators, 
we would expect such an algebraic characterization to 
include pieces of the fixed A state and output state po in 
the description — observe that this information is indeed 
included in the conditions. 



Theorem 3 A subsystem B is private for a channel 
&(p) — J2i VipV? with fixed A state a a and out- 
put state pa if and only if there are complex scalars 
Kjki forming an isometry A such that y/Pk^j\ipA,k) = 
Yli,i^ijkly/W\ < i>l)(i } B,i\, where \ipA,k) (Pk) and \4>i) (qi) 
are eigenstates (eigenvalues) of a a and po respectively, 
\ipB,i) is an orthonormal basis for B, and where \ipA,k) 
is viewed as a channel from B into S . 

The key observation in establishing this result is that 
the left and right hand sides of Eq. ([5]) each define chan- 
nels from B to S which are in fact the same. One can then 
use basic results from the theory of completely positive 
maps to obtain the equations spelled out in the theorem. 
Much more can be said on this topic; in particular this 
result can be strengthened in special cases such as the 
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case of private subspaces or operator private subsystems. 
We leave a more detailed investigation for flpj . 

Here we simply point out how the 2-qubit phase damp- 
ing example A decomposes in this way. In that case 
both A and B are both spanned by {|0), |1)}. The 
cigenstatcs of po = \li ar< 3 {|00), |01), |10), each 
having eigenvalue \. The eigenstates of a a — \h are 
{IV'A.fc)} = {|0),|1)}, with corresponding eigenvalues i. 
For brevity, we omit the matrix calculations for the op- 
erators Vj\ipA,k}', we note that they are 4x2 matrices 
formed with Pauli and 2x2 zero blocks. The scalar- 
valued matrix A = {Xijki) is indeed an isometry. Further- 
more, because the number of operators Vj\ipA,k) agrees 
with the number of operators \4>i){4>B,i\ (namely, 8), the 
matrix A is in fact unitary. 

Failure of complementarity with QEC 



in such a setting, moreover, when the input space is re- 
stricted to be that of our example, the complementary 
map is in fact private. Thus, not only docs the com- 
plementarity result fail, it fails dramatically. We save 
calculations and further discussion on this point for (Toj . 

Perhaps the notion of an error-correcting subsystem 
can be altered to mimic our new notion of a private quan- 
tum subsystem. A revised definition analogous to that of 
Dcf. [2] could be proposed: B is correctable for £ if there 
exists an operation TZ such that for all as and some fixed 
states a a, t~a, we have TZ o £{ua ® o~b) = ta® <jb- Yet, 
even under this new definition of error-correctable, the 
complementary channel A" cannot exhibit a correctable 
subsystem as the set of Kraus operators project onto a 
class of states that are insufficient to encode a qubit of 
information. As such, the only possibility for a com- 
plementarity result analogous to [8( is through a revised 
notion of the complementary channel. 



Numerous links have been made between aspects of 
quantum error correction, quantum cryptography, and 
quantum key distribution. In the case of operator private 
subsystems and error-correcting subsystems, the comple- 
mentarity theorem of Q discussed below establishes an 
algebraic bridge between the two fields. This firmly links 
the operator quantum error correction theory to that of 
operator private subsystems — results in one field can im- 
mediately be exported to the other. Thus, it is natural 
to ask whether such a result holds in this more general 
setting. To discuss this we first need the concept of com- 
plementary pairs of channels. 

As a consequence of the Stinespring dilation theorem 
[IH , every channel $ may be seen to arise from an envi- 
ronment Hilbcrt space E, a pure state \ip) on the environ- 
ment, and a unitary operator U on the composite S (g> E 
in the following sense: $(p) = Tr E (U(p® (i})\)U^) . 
Tracing out the system instead yields a complementary 
channel: &(p) = Tr s (U(p® (ip\)W) . The unique- 
ness built into this dilation theorem leads to a certain 
uniqueness with such a complementary pair, so that we 
may talk of "the" complementary channel $" for a given 
channel $ (HG^. 

We have already discussed operator private 
subsystems — the essential difference being that in- 
stead of a single state on A as in Definition [21 it is 
demanded that Eq. ([5]) holds for all states on A. Simi- 
larly, an operator quan tum error-correcting subsystem 
B for a channel £ 12, GH requires the existence of a 
correction operation TZ such that: Vavi Vers, 3ta for 
which 1Z o £(a a <£> <?b) = Ta ® &B- The main result 
of Q shows that B is private for $ if and only if it is 
error-correcting for <E>". 

Does this result extend to the more general setting? 
The Kraus operators of the complementary map A" are 
four orthogonal rank-one projectors in two-qubit Hilbert 
space. No error-correcting subsystem can be extracted 



CONCLUSION AND OUTLOOK 

We have studied a general notion of private quan- 
tum subsystems that encompasses all previously con- 
sidered instances as special cases. Taking motivation 
from quantum error correction, specifically the Knill- 
Laflamme conditions, we presented algebraic conditions 
that characterize when a code is private for a given chan- 
nel. We analyzed the development of private subsystems 
for the special case given by the composition of phase 
damping channels on many qubit Hilbert spaces. While 
each individual channel of this form is not private, the 
composition of such channels were shown to contain a pri- 
vate single qubit subsystem. Yet, for such classes of chan- 
nels no private subspace or operator private subsystem 
exists. Moreover, we discussed how the channel fails to 
have the corresponding complementary error-correctable 
pair as in the case of operator subsystems. Neverthe- 
less, this analysis naturally led us to define a potentially 
new form of quantum error-correcting code and warrants, 
along with the topic of channel complementarity, further 
investigation. And finally, preliminary discussions sug- 
gest there may be yet unexplored connections between 
the study of private quantum subsystems and notions of 
privacy in classical communication. In [Toj j and elsewhere 
we will continue and expand on the work initiated here. 
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